On high load netstat may incorrect output This server running mpd-5.3 as pptp server vpn8# ifconfig -lu | wc -w 1734 vpn8# netstat -w 1 -d -h input (Total) output packets errs bytes packets errs bytes colls drops 173K 0 89M 183K 0 129M 0 0 170K 0 89M 181K 0 129M 0 0 170K 0 89M 180K 0 128M 0 0 170K 0 89M 180K 0 127M 0 0 175K 0 91M 184K 0 130M 0 0 173K 0 90M 183K 0 129M 0 0 173K 0 90M 182K 0 129M 0 0 171K 0 89M 180K 0 127M 0 0 171K 0 89M 181K 0 129M 0 0 172K 0 89M 181K 0 128M 0 0 143K 0 88M 156K 0 107M 0 0 174K 0 91M 184K 0 131M 0 0 173K 0 90M 183K 0 130M 0 0 175K 0 91M 186K 0 131M 0 0 177K 0 92M 188K 0 133M 0 0 0 71M 0 0 0 171K 0 89M 179K 0 127M 0 0 171K 0 89M 181K 0 128M 0 0 175K 0 91M 186K 0 131M 0 0 70K 0 83M 52K 0 -20M 0 0 input (Total) output packets errs bytes packets errs bytes colls drops 174K 0 92M 184K 0 132M 0 0 175K 0 93M 184K 0 132M 0 0 174K 0 92M 184K 0 132M 0 0 135K 0 89M 145K 0 118M 0 0 172K 0 90M 181K 0 129M 0 0 171K 0 89M 182K 0 129M 0 0 172K 0 90M 183K 0 130M 0 0 171K 0 90M 182K 0 130M 0 0 173K 0 91M 183K 0 130M 0 0 ^C vpn8# netstat -w 1 input (Total) output packets errs bytes packets errs bytes colls 145159 0 82485349 153321 0 117743533 0 136895 0 79084654 145018 0 111877348 0 146279 0 81710082 153952 0 116857455 0 143634 0 80602950 152005 0 116127801 0 144205 0 81175701 151892 0 115836499 0 146342 0 83031415 153968 0 118093209 0 143365 0 80564430 151508 0 115702643 0 145253 0 82320881 153062 0 116675147 0 146909 0 81998714 155485 0 117155601 0 91507 0 76590439 79098 0 35481375 0 145148 0 81429871 153728 0 116617071 0 142632 0 80932248 150865 0 115942720 0 21918 0 74115278 18446744073709486002 0 18446744073585465790 0 142905 0 81095335 150861 0 115144168 0 142216 0 80410366 150408 0 114744557 0 142302 0 81065884 150364 0 115161521 0 141493 0 79316895 148997 0 112673424 0 ^C How-To-Repeat: run netstat -w 1 again
I believe I got this one figured out. I studied netstat's code and the actual loop is taking place inside function sidewaysintpr() contained in netstat/if.c so goto that function if you plan on reading the rest of this report. The reason you get bogus output is that the counters of various statistics that are kept for each interface are never again initialized to 0. This is the struct being used by the function to hold the various statistics that are printed. struct iftot { SLIST_ENTRY(iftot) chain; char ift_name[IFNAMSIZ]; /* interface name */ u_long ift_ip; /* input packets */ u_long ift_ie; /* input errors */ u_long ift_id; /* input drops */ u_long ift_op; /* output packets */ u_long ift_oe; /* output errors */ u_long ift_co; /* collisions */ u_int ift_dr; /* drops */ u_long ift_ib; /* input bytes */ u_long ift_ob; /* output bytes */ }; In each iteration we recompute (sum up) the counters of variable "sum" and what we actually print is the difference between current statistics that we gathered during the interval (defined by the -w arg) and the statistics of the previous loop. Take a look a this: show_stat("lu", 10, sum->ift_ib - total->ift_ib, 1); Since the counters for each statistic go only one way (up), eventually we are going to overflow. The counters inside "sum" are going to overflow slightly faster than "total's" counters so once in a while sum->ift_ib - total->ift_ib will yield a "negative number" because sum->ift_ib overflows and wraps near 0, becoming a small number in comparison to total->ift_ib In the next loop total will overflow as well and wrap around 0 itself, so no more crazy ultra long output. So the result of this subtraction, which is passed as a u_long, underflows and generates an enormously large value. Keep in mind than in 64bit archs a u_long is actually a really long number! So the max value for a u_long is around 2^64 = 1.84467441 * 10^19, close to what we see in the pr above. The pr originator has the amd64 version. Possible Fix: a) Implement an extra argument for netstat that re-initializes the statistics kept for each interface, of course it must be run by root. b) reboot the system In conclusion, I believe the state of the pr should change to "suspended" until someone submits a patch. I 'm sure I won't for at least 3 more weeks 'till university exam period is over. Cheers, -- Efstratios "GPF" Karatzas
State Changed From-To: open->suspended Mark suspended awaiting a patch.
For bugs matching the following conditions: - Status == In Progress - Assignee == "bugs@FreeBSD.org" - Last Modified Year <= 2017 Do - Set Status to "Open"
FreeBSD 117-14.cabletv.dp.ua 11.1-STABLE FreeBSD 11.1-STABLE #0 r330998: Thu Mar 15 16:26:18 UTC 2018 root@releng2.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC amd64 input (Total) output packets errs idrops bytes packets errs bytes colls 83603 0 0 65584859 110560 0 112649996 0 104057 0 0 72510205 132273 0 137489029 0 98032 0 0 72006742 126087 0 130965053 0 82552 0 0 58100322 104585 0 103487902 0 91958 0 0 67202544 118025 0 121544633 0 97041 0 0 71613270 117562 0 117377414 0 99809 0 0 68422003 134315 0 139541471 0 78343 0 0 54430330 94742 0 89730933 0 91508 0 0 67669917 114911 0 114776958 0 88137 0 0 65195746 120482 0 125233523 0 97980 0 0 73779067 132188 0 139616979 0 84857 0 0 64386149 113050 0 115001081 0 21714 0 0 56645597 18446744073709550495 0 18446744073679028375 0 86920 0 0 64471518 108388 0 107430533 0 100268 0 0 73075917 123870 0 124315594 0 91584 0 0 66405893 115563 0 108856611 0 91993 0 0 72204274 112837 0 100467293 0 75592 0 0 58219748 96739 0 93394775 0 ^C